CVE-2026-108960 Details
Description
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
A vulnerability allowing out-of-bounds read has been identified in Tiiny-AI PowerInfer versions prior to commit 8bd56d6. The issue arises in the FFN GPU-split Loader component, specifically within the create_striped_mat_to_gpu function of the ggml-cuda.cu file. This vulnerability is approached locally and has been made public, with available exploits.
A pull request has been submitted to address this vulnerability by adding proper validation of the indices in the GPU split sidecar before they are used, ensuring that all entries are checked against the bounds of the corresponding host tensor.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tiiny-AI/PowerInfer/ | [email protected] | Source CodeVendor |
| https://github.com/Tiiny-AI/PowerInfer/issues/284 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-108960 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/997933 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416779 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416779/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tiiny-AI PowerInfer | <= 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |